The ICH Q9 Revision and a Renewed Focus on Quality Risk Management Fundamentals

Magnifying glass and check mark icon. Business concept,idea,right choice, quality control, approval and contract assignment | ©olyphotostories - stock.adobe.com

The new revision of the International Council for Harmonisation’s (ICH) Q9, Quality Risk Management document utilizes the word ‘effective’ many times throughout, both in the context of quality risk management (QRM) and the pharmaceutical quality system (1). The definition of what ‘effective’ means in this context is different for each company, stakeholder, and facilitator involved in QRM activities, which has facilitated a wide divergence in the application of QRM and risk assessment across the industry. The revised guideline addresses the divergence in stakeholder background and perspective and links this effectively with the bias that has historically been evident in many risk assessments that formed part of existing QRM programs. The new revision accurately states, “subjectivity can directly impact the effectiveness of risk management activities and the decisions made. Therefore, it is important that subjectivity is managed and minimized.” A renewed focus on the basic set-up of the QRM process can significantly aid in meeting this requirement.

The new revision of ICH Q9 was timely, as the pharmaceutical industry had spent many years since the original version was published in 2005 trying to establish the look and feel of effective QRM while also struggling with QRM processes that became increasingly resource hungry and complex. Publication of the new revision in January 2023 heralded a new era in the design and implementation of QRM processes and provided an opportunity for review and re-establishment of the place of QRM throughout the pharmaceutical lifecycle. The new revision offered as its purpose a “systematic approach to quality risk management that leads to better, more informed, and timely decisions” (1).

One of the observations made across the industry since 2005 is the dichotomy of the enthusiasm with which companies have embraced QRM and the struggle they have had with understanding the importance of simplicity, clarity, and pragmatism that should form the basis of any risk management process. The industry is fully bought into the benefits of QRM but, at times, has struggled to fully realize the actual benefit that is possible when this process is implemented effectively. “Commensurate with the level of risk” has become a misnomer, and in some cases, the industry has fallen into a world controlled by failure mode and effects analysis (FMEA) and arduous capturing of information that is never revisited.

Planning of the QRM program and quality risk assessments

The first fundamental that has been often overlooked is the definition and planning of the structure and purpose of the QRM program. Section 4.2 specifically calls out “possible steps used to initiate and plan a quality risk management process,” and these include steps such as definition of the scope, the risk question, the definition of assumptions, and collation of relevant data (1). Often, the practice in reality has commenced with the selection of a tool and immediate commencement of a risk assessment without asking “what do we want to achieve?”. At the simplest level, a QRM program should help to identify quality risks before they occur, safeguarding patients but also reducing the time spent fixing issues that could have been avoided.

Setting boundaries around each risk assessment that is undertaken is a key driver for successful risk assessment. When performing a risk assessment, it is common for a cross functional group of people, who happen to have some availability in their calendar that week, to sit in front of a blank FMEA tool wondering where to begin.

To resolve these situations, every risk assessment should start with a strategy, commencing with setting the scope, and asking questions as follows:

• What type of risk are we concerned with?
• Risk to what?
• What part of the process are we concerned with?

The scope then leads to the risk question where one formulates the question that will be asked for each process step included in the scope. An example of a risk question would be, “What are the microbial risks that may impact product quality in the filling process from vial depyrogenation to tray-off?”. A well-thought-through risk question or statement performs an important function in making the QRM process efficient and effective. It prevents a risk assessment from taking a wrong turn or going down rabbit holes that cause confusion and derail the whole process.

Section 4.2 of the new revision of the ICH Q9 guideline has provided valuable information relating to this stage of the QRM process and has also encompassed the requirement to include pertinent assumptions in the risk assessment plan. Assumptions also provide additional bricks in the boundary provided by the scope and risk question and assist in the identification of routes to avoid, thus making the process more efficient. A common example is the assumption that personnel will follow procedures—this assumption is hugely valuable as it prevents the time-consuming assessment of the risk of each standard operating procedure (SOP) in the quality system not being followed by personnel, something that is notoriously difficult to mitigate. Assumptions help one to focus on the risk assessment task at hand, which ultimately makes the risk assessment process more efficient.

Once the purpose, boundaries, scope, risk question, and assumptions have been thought through and agreed, a common result is that the correct tool for capturing the risk assessment itself becomes evident. Taking the time to really think about what the risk assessment aims to achieve can really help to ensure it gets off to the right start.

The right tool for the job

Risk assessment tools are many and varied in the industry, and it is useful to remember that the function of a risk assessment tool is to capture the risk assessment thought process accurately and clearly, ensuring that the information captured therein is logical and available for future readers to understand. A tool may be as simple as a memo to capture a risk decision to something more formal and complex such as the common FMEA tool. Section 5 and Annex 1 of the new revision of ICH Q9 provide comprehensive examples of tools that can be considered and used as building blocks for the ideal tool for the risk assessment
being undertaken.

Once a tool has been selected, the mechanism for scoring the risk levels needs to be considered, and this step in the process is of paramount importance for the prevention of bias and also for ensuring that the risk assessment is meaningful. Many older scoring systems included statistical probabilities for likelihood of occurrence. In today’s advanced pharmaceutical industry, a one in 1000 probability of a contamination event, historically seen as low, is not acceptable. More meaningful barometers of risk must be captured to ensure QRM is effective. For example, when dealing with contamination risk, the number and type of controls in place may be a more meaningful way of establishing likelihood of occurrence.

These scoring systems may need to be altered and adjusted to keep them meaningful, depending on the risk assessment scope. QRM programs where scoring is locked down provides many problems when the risk assessment at hand doesn’t fall neatly into the boundaries mandated by a procedure.

Management and control of subjectivity or bias

The new revision of ICH Q9 states that “subjectivity can be introduced in quality risk management through differences in how risks are assessed and in how hazards, harms, and risks are perceived by different stakeholders” (1). This ‘bias’ that has been common across the application of QRM in the industry has been one of the hurdles to the implementation of truly effective QRM programs.

As mentioned previously, the incorporation of a strong and objective scoring mechanism which is descriptive, clear, and relevant to the risk assessment being conducted can be the biggest control and mitigation against subjectivity and bias in the QRM process. Another area related to risk assessments and often observed during regulatory inspections is the failure to assess all process steps or operations in terms of risk, resulting in relevant risks not being identified, documented, and subjected to the risk question. This is another significant source of bias in the process with process steps that have been historically compliant and trouble free not being considered in the QRM process and then taking companies by surprise when they go wrong. Similarly, steps in the process that have most recently caused issues may be unfairly prioritized in terms of risk due to familiarity, rather than true potential to cause harm.

The definition of a process flow is key to preventing subjectivity and is relatively simple when it is a recognizable process that is undergoing risk assessment. When the subject of the risk assessment does not have an obvious process, it can take effort to establish and document the process flow, but it can be assured that everything done is performed in a step-wise manner and with some patience and cross-functional insight, a process flow can always be determined.

The new revision states, “all participants involved with quality risk management activities should acknowledge, anticipate, and address the potential for subjectivity”, and everyone can comply with this statement by ensuring that each QRM process starts with the establishment of the correct boundaries as defined by the risk question, assumptions, scoring definitions, and process flow description that are included in each of quality risk assessments.

How effective is the QRM process?

When each of these fundamentals are understood and implemented, the risk assessment process itself becomes relatively straightforward, logical, and efficient. For the overall QRM plan to be effective, the number of risk assessments that form the QRM program should not be allowed to increase exponentially. If this happens, it is certain that preceding risk assessments are not being reviewed and revised, and thus information is lost and the ongoing narrative relating to the process is disrupted. ICH Q9 (R1) describes QRM as “part of building knowledge and understanding risk scenarios, so that appropriate risk control can be decided upon for use during the commercial manufacturing phase” indicating that each time the level of knowledge increases, the knowledge captured in the QRM process should also increase.

QRM is cyclical in nature (i.e., one starts with the initial assessment but as things change, one revisits the previous iteration and ensures that information contained in the QRM plan is constantly updated and revised). The ultimate goal is that the QRM program, and the documents contained within it, can provide a roadmap to any pharmaceutical process or activity, capturing the successes such as innovative design and state-of-the-art controls as well as the risks and potential pitfalls. Ultimately, to be effective, efforts and priorities will be concentrated around these risks, increasing efficiency without compromising patient safety or medicinal product availability.

Deviations are often raised as a result of something going wrong in processes, but interestingly, many companies do not use deviation numbers as an indicator of the maturity of their QRM program. An increasing number of production deviations will often indicate the failure to proactively identify and mitigate risk. This connection between common quality key performance indicators such as deviations, and the QRM program provides an opportunity to continuously assess QRM effectiveness. We should be aiming for a QRM program that will proactively identify risks and failures, giving us the headspace and opportunity to fix issues before they become a time bound problem with potential impact on product quality, patient safety, or drug availability.

Reference

1. ICH. Q9(R1) Quality Risk Management (ICH, January 2023).

About the author

Kate Coleman is Principal Quality and Compliance Consultant with Arriello Ireland.

Article details

Pharmaceutical Technology®
Vol. 47, No. 12
December 2023
Pages: 28-30

Citation

When referring to this article, please cite it as Coleman, K. The ICH Q9 Revision and a Renewed Focus on Quality Risk Management Fundamentals. Pharmaceutical Technology 2023 47 (12).